N10-009 - Network Operations (19% of the exam) - Section 3.1

Use appropriate statistics and sensors to ensure network availability, including SNMP, flow data, logs, and baseline performance metrics.

Use monitoring tools and sensors - SNMP polling and traps, NetFlow/sFlow, syslog, and SIEM collection - to observe network health and detect anomalies against an established baseline. Interpret interface counters, utilisation, latency, jitter, and packet-loss metrics to identify a degraded link or oversubscribed segment before it causes an outage.

SNMPFlow data (NetFlow/sFlow)SyslogPerformance baselines

Practice question for this objective

Free sampleNetwork Operationsmedium

An administrator already collects interface throughput with SNMP but cannot tell which hosts or applications are consuming a saturated link. Which capability does flow data such as NetFlow add over SNMP interface polling?

  • AFlow data breaks utilisation down by conversation, exposing the source and destination addresses, ports, and protocols that SNMP reports merely as an aggregate byte count. Correct
  • BFlow data reports the temperature, fan speed, and power draw of the device chassis, environmental facts that SNMP interface counters cannot expose.
  • CFlow data encrypts the management channel between the device and the collector, closing the clear-text exposure that SNMPv2c polling leaves open.
  • DFlow data guarantees loss-free delivery of every record over TCP, whereas SNMP counter polling is dropped first on a congested link.
Flow data identifies the hosts, ports, and protocols behind link utilisation, whereas SNMP interface polling reports only aggregate counters. SNMP interface counters expose total bytes and packets per interface but not their composition; flow records carry the addressing and port fields for each conversation, so an analyst can attribute utilisation to specific talkers and applications.

Why A is correct: Correct: flow records carry the addressing and port fields for each conversation, so utilisation that SNMP reports as one aggregate counter can be attributed to specific hosts and applications.

Why B is wrong: Chassis temperature and power come from environmental sensors, not flow records, so this describes a different sensor type and is not what flow data adds over SNMP.

Why C is wrong: SNMPv2c is indeed clear text, which makes encryption sound relevant, but flow export does not encrypt management traffic; that is a security control unrelated to what flow data reveals.

Why D is wrong: Flow records are commonly exported over UDP, not guaranteed TCP delivery, so this misstates the transport and is not the advantage flow data provides over SNMP.

See more N10-009 practice questions, answers explained.

Exam traps in Network Operations

Answers that look right on this material and are not. Each one is a distractor from a different question in the N10-009 bank for this domain.

  • It defines the contractual uptime percentage that the service provider must guarantee to the organisation each month.

    Why it is wrong: Tempting because guaranteed uptime is also documented and tracked, but a guaranteed uptime figure is a service-level agreement, not a captured record of normal performance metrics.

  • UDP port 161, the same port already used for successful polling.

    Why it is wrong: UDP 161 is where the agent listens for the manager's polling requests, which already work here; notifications are not sent to this port, so opening it does not fix the problem.

  • NetFlow relies on random packet sampling in the switch ASIC, while sFlow inspects every packet to build exact per-flow byte counts.

    Why it is wrong: This reverses the two technologies; sampling in the ASIC describes sFlow, and per-flow accounting describes NetFlow, so the roles are swapped and the statement is wrong.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.